Law / United States / 
Michigan
Identity Theft Protection Act, personal information and personal identifying information defined
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Do not assume Michigan's broader "personal identifying information" term (MCL 445.63(q)), which includes biometrics, is the breach-notice trigger. The trigger is the narrower "personal information" term (MCL 445.63(r)), which excludes biometrics.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does 'in combination with any required security code, access code, or password' in MCL 445.63(r)(iii) qualify only a credit card or debit card number, or also a demand deposit or other financial account number?
What it makes you log
Logging duty
The section only defines terms used elsewhere in the Act, among them agency, person, personal identifying information and personal information. It requires no log or record to be kept and names no audit or access to a record. The breach-notice duty and its notice to consumer reporting agencies sit in section 445.72, which this row does not cite. The territorial hook is the resident element of the definition of personal information in subdivision (r); the definition of personal identifying information in subdivision (q) has none.
- Kind
- None
- As of
What this law does
MCL 445.63 defines two distinct terms that must not be conflated. "Personal information," MCL 445.63(r), is a name combined with a Social Security number, driver's license or state ID number, or financial account or card number with an access code; it does not include biometric data.
"Personal identifying information," MCL 445.63(q), is a broader term, used for the Act's identity-theft-prevention and criminal provisions elsewhere in the chapter, that does include biometrics among many other data elements such as address, employer, government passport number, and account passwords. Only the narrower "personal information" term is the breach-notice trigger at MCL 445.72. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .